Getting Data In

How to monitor Microsoft CA logs on Server 2008 R2?

Builder

Has anyone been successful in monitoring Microsoft CA logs on Server 2008 R2? It looks as if they are being written to C:\Windows\System32\CertLog in EDB log format, which is not human readable. I want to say the EDB log format might also be used by Microsoft Exchange, so I don't know if any TA or SA for exchange could be leveraged.

Any assistance with this issue would be appreciated.

Thanks

Tags (2)
0 Karma
1 Solution

Builder

Figured out the issue. There was an additional auditing setting that needed to be tweaked in the GPO before the CA events started showing up in the WinEventLog:Security. No need to try and figure out a way to monitor the edb files.

View solution in original post

0 Karma

Builder

Figured out the issue. There was an additional auditing setting that needed to be tweaked in the GPO before the CA events started showing up in the WinEventLog:Security. No need to try and figure out a way to monitor the edb files.

View solution in original post

0 Karma

Champion

would be helpful, if you could provide how did you fix this.

————————————
If this helps, give a like below.
0 Karma

Builder

Do you remember what change did you make in GPO in order to collect CerLog like EventCode=64 etc?

0 Karma

Path Finder

What was the solution?

0 Karma

Builder

early morning bump. No one is monitoring any Microsoft CA servers running on 2008 R2 with Splunk?

0 Karma